Amazon Sales Estimator

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:29 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Amazon sales-estimation guide, with some normal but important caution around live web lookups and unpinned global install examples.

Before installing, verify the publisher and source repository, consider avoiding global installation unless you want the skill available across sessions, and be aware that ASINs, Amazon URLs, and keywords used in lookup modes may be sent to external web services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Package Execution and Global Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14, 298, 312, and 326
Vulnerability Type: Supply-chain risk from mutable, unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# SKILL.md:14
npx skills add nexscope-ai/Amazon-Skills --skill amazon-sales-estimator -g

# SKILL.md:298
npx skills add nexscope-ai/Amazon-Skills --skill amazon-keyword-research -g

# SKILL.md:312
npx skills add nexscope-ai/Amazon-Skills --skill amazon-listing-optimization -g

# SKILL.md:326
npx skills add nexscope-ai/Amazon-Skills --skill amazon-ppc-campaign -g

Technical Analysis

The documented commands invoke npx without pinning the skills npm package to a reviewed version. Depending on the local npm configuration and cache state, npx may retrieve and execute the current package version from a configured registry.

The referenced nexscope-ai/Amazon-Skills repository and individual skills are also not pinned to immutable commit hashes or verified releases. Consequently, the code and instructions installed by these commands can change after this artifact has been reviewed. The -g flag installs the selected skills globally, increasing their availability and the duration of exposure beyond a single isolated project.

This is a supply-chain weakness rather than evidence that the currently referenced dependencies are malicious. The risk arises because upstream registry packages, publisher accounts, repositories, or branches could be compromised or changed without corresponding changes to this audited file.

Attack Path

1. An attacker compromises the npm package used by npx, its publisher account, the configured package registry, or the referenced GitHub repository.
2. The attacker publishes a malicious package version or modifies the mutable repository content.
3. A user follows one of the documented installation commands.
4. npx retrieves and executes the unpinned pac ...[truncated 970 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills npm package to an explicitly reviewed version rather than invoking an unversioned package through npx.
2. Pin the source repository to a verified immutable commit hash or signed release tag.
3. Record and verify integrity hashes for downloaded packages and skill artifacts where tooling supports this.
4. Remove -g from the default installation instructions and prefer project-local or otherwise isolated installation.
5. Require users to inspect the resolved package and skill contents before activation.
6. Use a lockfile, trusted registry, and restrictive npm configuration where applicable.
7. Run installation in a sandbox or container with minimal filesystem, credential, and network access.
8. Document the exact reviewed package version, repository commit, expected publisher identity, and integrity metadata.
9. Add automated dependency monitoring and require renewed review whenever the pinned package or commit is updated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The installation command uses npx skills without pinning a specific package version, so users may execute whatever version is current at install time. If the upstream package is compromised, typosquatted, or introduces breaking/security-relevant changes, the skill installation path becomes a supply-chain risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes ASIN Lookup and Keyword Market Analysis as if they are local operations, but they perform live web_fetch/web_search requests against Amazon using user-supplied ASINs, URLs, or keywords. Without an explicit user-facing warning, users may unknowingly transmit sensitive research targets, proprietary product ideas, or tracking parameters to external services.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This chained-skill installation example again invokes npx skills without a pinned version, exposing users to execution of unreviewed upstream code. Repeated unpinned examples increase the chance that users will copy and run a mutable command from documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documentation instructs users to run an unpinned npx command, which is a classic software supply-chain weakness because the resolved package can change over time. In a skill ecosystem, this is especially risky because users may assume examples are safe to execute verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Another unpinned npx skills command appears in the integration guidance, creating the same supply-chain exposure as the earlier examples. Because it is embedded in workflow documentation, it may be executed routinely by users chaining related skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.